1da6c28aaSamw /* 2da6c28aaSamw * CDDL HEADER START 3da6c28aaSamw * 4da6c28aaSamw * The contents of this file are subject to the terms of the 5da6c28aaSamw * Common Development and Distribution License (the "License"). 6da6c28aaSamw * You may not use this file except in compliance with the License. 7da6c28aaSamw * 8da6c28aaSamw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9da6c28aaSamw * or http://www.opensolaris.org/os/licensing. 10da6c28aaSamw * See the License for the specific language governing permissions 11da6c28aaSamw * and limitations under the License. 12da6c28aaSamw * 13da6c28aaSamw * When distributing Covered Code, include this CDDL HEADER in each 14da6c28aaSamw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15da6c28aaSamw * If applicable, add the following below this CDDL HEADER, with the 16da6c28aaSamw * fields enclosed by brackets "[]" replaced with your own identifying 17da6c28aaSamw * information: Portions Copyright [yyyy] [name of copyright owner] 18da6c28aaSamw * 19da6c28aaSamw * CDDL HEADER END 20da6c28aaSamw */ 21da6c28aaSamw /* 227f667e74Sjose borrego * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23da6c28aaSamw * Use is subject to license terms. 24da6c28aaSamw */ 25da6c28aaSamw 26da6c28aaSamw /* 27da6c28aaSamw * Notes on the virtual circuit (VC) values in the SMB Negotiate 28da6c28aaSamw * response and SessionSetupAndx request. 29da6c28aaSamw * 30da6c28aaSamw * A virtual circuit (VC) represents a connection between a client and a 31da6c28aaSamw * server using a reliable, session oriented transport protocol, such as 32da6c28aaSamw * NetBIOS or TCP/IP. Originally, each SMB session was restricted to a 33da6c28aaSamw * single underlying transport connection, i.e. a single NetBIOS session, 34da6c28aaSamw * which limited performance for raw data transfers. 35da6c28aaSamw * 36da6c28aaSamw * The intention behind multiple VCs was to improve performance by 37da6c28aaSamw * allowing parallelism over each NetBIOS session. For example, raw data 38da6c28aaSamw * could be transmitted using a different VC from other types of SMB 39da6c28aaSamw * requests to remove the interleaving restriction while a raw transfer 40da6c28aaSamw * is in progress. So the MaxNumberVcs field was added to the negotiate 41da6c28aaSamw * response to make the number of VCs configurable and to allow servers 42da6c28aaSamw * to specify how many they were prepared to support per session 43da6c28aaSamw * connection. This turned out to be difficult to manage and, with 44da6c28aaSamw * technology improvements, it has become obsolete. 45da6c28aaSamw * 46da6c28aaSamw * Servers should set the MaxNumberVcs value in the Negotiate response 47da6c28aaSamw * to 1. Clients should probably ignore it. If a server receives a 48da6c28aaSamw * SessionSetupAndx with a VC value of 0, it should close all other 49da6c28aaSamw * VCs to that client. If it receives a non-zero VC, it should leave 50da6c28aaSamw * other VCs in tact. 51da6c28aaSamw * 52da6c28aaSamw */ 53da6c28aaSamw 54da6c28aaSamw /* 55da6c28aaSamw * SMB: negotiate 56da6c28aaSamw * 57da6c28aaSamw * Client Request Description 58da6c28aaSamw * ============================ ======================================= 59da6c28aaSamw * 60da6c28aaSamw * UCHAR WordCount; Count of parameter words = 0 61da6c28aaSamw * USHORT ByteCount; Count of data bytes; min = 2 62da6c28aaSamw * struct { 63da6c28aaSamw * UCHAR BufferFormat; 0x02 -- Dialect 64da6c28aaSamw * UCHAR DialectName[]; ASCII null-terminated string 65da6c28aaSamw * } Dialects[]; 66da6c28aaSamw * 67da6c28aaSamw * The Client sends a list of dialects that it can communicate with. The 68da6c28aaSamw * response is a selection of one of those dialects (numbered 0 through n) 69da6c28aaSamw * or -1 (hex FFFF) indicating that none of the dialects were acceptable. 70da6c28aaSamw * The negotiate message is binding on the virtual circuit and must be 71da6c28aaSamw * sent. One and only one negotiate message may be sent, subsequent 72da6c28aaSamw * negotiate requests will be rejected with an error response and no action 73da6c28aaSamw * will be taken. 74da6c28aaSamw * 75da6c28aaSamw * The protocol does not impose any particular structure to the dialect 76da6c28aaSamw * strings. Implementors of particular protocols may choose to include, 77da6c28aaSamw * for example, version numbers in the string. 78da6c28aaSamw * 79da6c28aaSamw * If the server does not understand any of the dialect strings, or if PC 80da6c28aaSamw * NETWORK PROGRAM 1.0 is the chosen dialect, the response format is 81da6c28aaSamw * 82da6c28aaSamw * Server Response Description 83da6c28aaSamw * ============================ ======================================= 84da6c28aaSamw * 85da6c28aaSamw * UCHAR WordCount; Count of parameter words = 1 86da6c28aaSamw * USHORT DialectIndex; Index of selected dialect 87da6c28aaSamw * USHORT ByteCount; Count of data bytes = 0 88da6c28aaSamw * 89da6c28aaSamw * If the chosen dialect is greater than core up to and including 90da6c28aaSamw * LANMAN2.1, the protocol response format is 91da6c28aaSamw * 92da6c28aaSamw * Server Response Description 93da6c28aaSamw * ============================ ======================================= 94da6c28aaSamw * 95da6c28aaSamw * UCHAR WordCount; Count of parameter words = 13 96da6c28aaSamw * USHORT DialectIndex; Index of selected dialect 97da6c28aaSamw * USHORT SecurityMode; Security mode: 98da6c28aaSamw * bit 0: 0 = share, 1 = user 99da6c28aaSamw * bit 1: 1 = use challenge/response 100da6c28aaSamw * authentication 101da6c28aaSamw * USHORT MaxBufferSize; Max transmit buffer size (>= 1024) 102da6c28aaSamw * USHORT MaxMpxCount; Max pending multiplexed requests 103da6c28aaSamw * USHORT MaxNumberVcs; Max VCs between client and server 104da6c28aaSamw * USHORT RawMode; Raw modes supported: 105da6c28aaSamw * bit 0: 1 = Read Raw supported 106da6c28aaSamw * bit 1: 1 = Write Raw supported 107da6c28aaSamw * ULONG SessionKey; Unique token identifying this session 108da6c28aaSamw * SMB_TIME ServerTime; Current time at server 109da6c28aaSamw * SMB_DATE ServerDate; Current date at server 110da6c28aaSamw * USHORT ServerTimeZone; Current time zone at server 111da6c28aaSamw * USHORT EncryptionKeyLength; MBZ if this is not LM2.1 112da6c28aaSamw * USHORT Reserved; MBZ 113da6c28aaSamw * USHORT ByteCount Count of data bytes 114da6c28aaSamw * UCHAR EncryptionKey[]; The challenge encryption key 115da6c28aaSamw * STRING PrimaryDomain[]; The server's primary domain 116da6c28aaSamw * 117da6c28aaSamw * MaxBufferSize is the size of the largest message which the client can 118da6c28aaSamw * legitimately send to the server 119da6c28aaSamw * 120da6c28aaSamw * If bit0 of the Flags field is set in the negotiate response, this 121da6c28aaSamw * indicates the server supports the SMB_COM_LOCK_AND_READ and 122da6c28aaSamw * SMB_COM_WRITE_AND_UNLOCK client requests. 123da6c28aaSamw * 124da6c28aaSamw * If the SecurityMode field indicates the server is running in user mode, 125da6c28aaSamw * the client must send appropriate SMB_COM_SESSION_SETUP_ANDX requests 126da6c28aaSamw * before the server will allow the client to access resources. If the 127da6c28aaSamw * SecurityMode fields indicates the client should use challenge/response 128da6c28aaSamw * authentication, the client should use the authentication mechanism 129da6c28aaSamw * specified in section 2.10. 130da6c28aaSamw * 131da6c28aaSamw * Clients should submit no more than MaxMpxCount distinct unanswered SMBs 132da6c28aaSamw * to the server when using multiplexed reads or writes (see sections 5.13 133da6c28aaSamw * and 5.25) 134da6c28aaSamw * 135da6c28aaSamw * Clients using the "MICROSOFT NETWORKS 1.03" dialect use a different 136da6c28aaSamw * form of raw reads than documented here, and servers are better off 137da6c28aaSamw * setting RawMode in this response to 0 for such sessions. 138da6c28aaSamw * 139da6c28aaSamw * If the negotiated dialect is "DOS LANMAN2.1" or "LANMAN2.1", then 140da6c28aaSamw * PrimaryDomain string should be included in this response. 141da6c28aaSamw * 142da6c28aaSamw * If the negotiated dialect is NT LM 0.12, the response format is 143da6c28aaSamw * 144da6c28aaSamw * Server Response Description 145da6c28aaSamw * ========================== ========================================= 146da6c28aaSamw * 147da6c28aaSamw * UCHAR WordCount; Count of parameter words = 17 148da6c28aaSamw * USHORT DialectIndex; Index of selected dialect 149da6c28aaSamw * UCHAR SecurityMode; Security mode: 150da6c28aaSamw * bit 0: 0 = share, 1 = user 151da6c28aaSamw * bit 1: 1 = encrypt passwords 152da6c28aaSamw * USHORT MaxMpxCount; Max pending multiplexed requests 153da6c28aaSamw * USHORT MaxNumberVcs; Max VCs between client and server 154da6c28aaSamw * ULONG MaxBufferSize; Max transmit buffer size 155da6c28aaSamw * ULONG MaxRawSize; Maximum raw buffer size 156da6c28aaSamw * ULONG SessionKey; Unique token identifying this session 157da6c28aaSamw * ULONG Capabilities; Server capabilities 158da6c28aaSamw * ULONG SystemTimeLow; System (UTC) time of the server (low). 159da6c28aaSamw * ULONG SystemTimeHigh; System (UTC) time of the server (high). 160da6c28aaSamw * USHORT ServerTimeZone; Time zone of server (min from UTC) 161da6c28aaSamw * UCHAR EncryptionKeyLength; Length of encryption key. 162da6c28aaSamw * USHORT ByteCount; Count of data bytes 163da6c28aaSamw * UCHAR EncryptionKey[]; The challenge encryption key 164da6c28aaSamw * UCHAR OemDomainName[]; The name of the domain (in OEM chars) 165da6c28aaSamw * 166da6c28aaSamw * In addition to the definitions above, MaxBufferSize is the size of the 167da6c28aaSamw * largest message which the client can legitimately send to the server. 168da6c28aaSamw * If the client is using a connectionless protocol, MaxBufferSize must be 169da6c28aaSamw * set to the smaller of the server's internal buffer size and the amount 170da6c28aaSamw * of data which can be placed in a response packet. 171da6c28aaSamw * 172da6c28aaSamw * MaxRawSize specifies the maximum message size the server can send or 173da6c28aaSamw * receive for SMB_COM_WRITE_RAW or SMB_COM_READ_RAW. 174da6c28aaSamw * 175da6c28aaSamw * Connectionless clients must set Sid to 0 in the SMB request header. 176da6c28aaSamw * 177da6c28aaSamw * Capabilities allows the server to tell the client what it supports. 178*bbf6f00cSJordan Brown * The bit definitions defined in smb.h. Bit 0x2000 used to be set in 179da6c28aaSamw * the negotiate response capabilities but it caused problems with 180da6c28aaSamw * Windows 2000. It is probably not valid, it doesn't appear in the 181da6c28aaSamw * CIFS spec. 182da6c28aaSamw * 183da6c28aaSamw * 4.1.1.1 Errors 184da6c28aaSamw * 185da6c28aaSamw * SUCCESS/SUCCESS 186da6c28aaSamw * ERRSRV/ERRerror 187da6c28aaSamw */ 188da6c28aaSamw #include <sys/types.h> 189da6c28aaSamw #include <sys/strsubr.h> 190da6c28aaSamw #include <sys/socketvar.h> 191da6c28aaSamw #include <sys/socket.h> 192da6c28aaSamw #include <sys/random.h> 193da6c28aaSamw #include <netinet/in.h> 194*bbf6f00cSJordan Brown #include <smbsrv/smb_kproto.h> 195da6c28aaSamw #include <smbsrv/smbinfo.h> 196da6c28aaSamw 197da6c28aaSamw /* 198da6c28aaSamw * Maximum buffer size for DOS: chosen to be the same as NT. 199da6c28aaSamw * Do not change this value, DOS is very sensitive to it. 200da6c28aaSamw */ 201da6c28aaSamw #define SMB_DOS_MAXBUF 0x1104 202da6c28aaSamw 203da6c28aaSamw /* 204da6c28aaSamw * The DOS TCP rcvbuf is set to 8700 because DOS 6.1 seems to have problems 205da6c28aaSamw * with other values. DOS 6.1 seems to depend on a window value of 8700 to 206da6c28aaSamw * send the next set of data. If we return a window value of 40KB, after 207da6c28aaSamw * sending 8700 bytes of data, it will start the next set of data from 40KB 208da6c28aaSamw * instead of 8.7k. Why 8.7k? We have no idea; it is the value that NT uses. 209da6c28aaSamw * September 2000. 210da6c28aaSamw * 211da6c28aaSamw * IR104720 Increased smb_nt_tcp_rcvbuf from 40KB to just under 1MB to allow 212da6c28aaSamw * for a larger TCP window sizei based on observations of Windows 2000 and 213da6c28aaSamw * performance testing. March 2003. 214da6c28aaSamw */ 215faa1795aSjb150015 static uint32_t smb_dos_tcp_rcvbuf = 8700; 216faa1795aSjb150015 static uint32_t smb_nt_tcp_rcvbuf = 1048560; /* scale factor of 4 */ 217da6c28aaSamw 218faa1795aSjb150015 static void smb_get_security_info(smb_request_t *, unsigned short *, 219faa1795aSjb150015 unsigned char *, unsigned char *, uint32_t *); 220da6c28aaSamw 221da6c28aaSamw /* 222da6c28aaSamw * Function: int smb_com_negotiate(struct smb_request *) 223da6c28aaSamw */ 224faa1795aSjb150015 smb_sdrc_t 225faa1795aSjb150015 smb_pre_negotiate(smb_request_t *sr) 226faa1795aSjb150015 { 227faa1795aSjb150015 DTRACE_SMB_1(op__Negotiate__start, smb_request_t *, sr); 228eb1d736bSafshin salek ardakani - Sun Microsystems - Irvine United States smb_rwx_rwenter(&sr->session->s_lock, RW_WRITER); 229faa1795aSjb150015 return (SDRC_SUCCESS); 230faa1795aSjb150015 } 231faa1795aSjb150015 232faa1795aSjb150015 void 233faa1795aSjb150015 smb_post_negotiate(smb_request_t *sr) 234faa1795aSjb150015 { 235faa1795aSjb150015 DTRACE_SMB_1(op__Negotiate__done, smb_request_t *, sr); 236eb1d736bSafshin salek ardakani - Sun Microsystems - Irvine United States smb_rwx_rwexit(&sr->session->s_lock); 237faa1795aSjb150015 } 238da6c28aaSamw 2397b59d02dSjb150015 smb_sdrc_t 240faa1795aSjb150015 smb_com_negotiate(smb_request_t *sr) 241da6c28aaSamw { 242da6c28aaSamw int dialect = 0; 243da6c28aaSamw int this_dialect; 244da6c28aaSamw unsigned char keylen; 245da6c28aaSamw int sel_pos = -1; 246da6c28aaSamw int pos; 247da6c28aaSamw char key[32]; 248da6c28aaSamw char *p; 249da6c28aaSamw timestruc_t time_val; 250da6c28aaSamw unsigned short secmode; 251da6c28aaSamw uint32_t sesskey; 252da6c28aaSamw uint32_t capabilities = 0; 2537b59d02dSjb150015 int rc; 254da6c28aaSamw unsigned short max_mpx_count; 255c8ec8eeaSjose borrego int16_t tz_correction; 2567f667e74Sjose borrego char ipaddr_buf[INET6_ADDRSTRLEN]; 257b89a8333Snatalie li - Sun Microsystems - Irvine United States char *tmpbuf; 258b89a8333Snatalie li - Sun Microsystems - Irvine United States int buflen; 259b89a8333Snatalie li - Sun Microsystems - Irvine United States smb_msgbuf_t mb; 260da6c28aaSamw 261da6c28aaSamw if (sr->session->s_state != SMB_SESSION_STATE_ESTABLISHED) { 262da6c28aaSamw /* The protocol has already been negotiated. */ 263dc20a302Sas200622 smbsr_error(sr, 0, ERRSRV, ERRerror); 264faa1795aSjb150015 return (SDRC_ERROR); 265da6c28aaSamw } 266da6c28aaSamw 267da6c28aaSamw for (pos = 0; 268da6c28aaSamw sr->smb_data.chain_offset < sr->smb_data.max_bytes; 269da6c28aaSamw pos++) { 2703db3f65cSamw if (smb_mbc_decodef(&sr->smb_data, "%L", sr, &p) != 0) { 271dc20a302Sas200622 smbsr_error(sr, 0, ERRSRV, ERRerror); 272faa1795aSjb150015 return (SDRC_ERROR); 273da6c28aaSamw } 274da6c28aaSamw 275da6c28aaSamw this_dialect = smb_xlate_dialect_str_to_cd(p); 276da6c28aaSamw 277da6c28aaSamw if (this_dialect < 0) 278da6c28aaSamw continue; 279da6c28aaSamw 280da6c28aaSamw if (dialect < this_dialect) { 281da6c28aaSamw dialect = this_dialect; 282da6c28aaSamw sel_pos = pos; 283da6c28aaSamw } 284da6c28aaSamw } 285da6c28aaSamw 286da6c28aaSamw smb_get_security_info(sr, &secmode, (unsigned char *)key, 287da6c28aaSamw &keylen, &sesskey); 288da6c28aaSamw 289da6c28aaSamw (void) microtime(&time_val); 290c8ec8eeaSjose borrego tz_correction = sr->sr_gmtoff / 60; 291da6c28aaSamw 292da6c28aaSamw switch (dialect) { 293da6c28aaSamw case PC_NETWORK_PROGRAM_1_0: /* core */ 2940f1702c5SYu Xiangning (void) ksocket_setsockopt(sr->session->sock, SOL_SOCKET, 2950f1702c5SYu Xiangning SO_RCVBUF, (const void *)&smb_dos_tcp_rcvbuf, 2960f1702c5SYu Xiangning sizeof (smb_dos_tcp_rcvbuf), CRED()); 2977b59d02dSjb150015 rc = smbsr_encode_result(sr, 1, 0, "bww", 1, sel_pos, 0); 298da6c28aaSamw break; 299da6c28aaSamw 300da6c28aaSamw case Windows_for_Workgroups_3_1a: 301da6c28aaSamw case PCLAN1_0: 302da6c28aaSamw case MICROSOFT_NETWORKS_1_03: 303da6c28aaSamw case MICROSOFT_NETWORKS_3_0: 304da6c28aaSamw case LANMAN1_0: 305da6c28aaSamw case LM1_2X002: 306da6c28aaSamw case DOS_LM1_2X002: 3070f1702c5SYu Xiangning (void) ksocket_setsockopt(sr->session->sock, SOL_SOCKET, 3080f1702c5SYu Xiangning SO_RCVBUF, (const void *)&smb_dos_tcp_rcvbuf, 3090f1702c5SYu Xiangning sizeof (smb_dos_tcp_rcvbuf), CRED()); 310da6c28aaSamw sr->smb_flg |= SMB_FLAGS_LOCK_AND_READ_OK; 3117b59d02dSjb150015 rc = smbsr_encode_result(sr, 13, VAR_BCC, 3123db3f65cSamw "bwwwwwwlYww2.w#c", 313da6c28aaSamw 13, /* wct */ 314da6c28aaSamw sel_pos, /* dialect index */ 315da6c28aaSamw secmode, /* security mode */ 316da6c28aaSamw SMB_DOS_MAXBUF, /* max buffer size */ 317da6c28aaSamw 1, /* max MPX (temporary) */ 318da6c28aaSamw 1, /* max VCs (temporary, ambiguous) */ 319da6c28aaSamw 3, /* raw mode (s/b 3) */ 320da6c28aaSamw sesskey, /* session key */ 321da6c28aaSamw time_val.tv_sec, /* server time/date */ 322c8ec8eeaSjose borrego tz_correction, 323da6c28aaSamw (short)keylen, /* Encryption Key Length */ 324da6c28aaSamw /* reserved field handled 2. */ 325da6c28aaSamw VAR_BCC, 326da6c28aaSamw (int)keylen, 327da6c28aaSamw key); /* encryption key */ 328da6c28aaSamw break; 329da6c28aaSamw 330da6c28aaSamw case DOS_LANMAN2_1: 331da6c28aaSamw case LANMAN2_1: 3320f1702c5SYu Xiangning (void) ksocket_setsockopt(sr->session->sock, SOL_SOCKET, 3330f1702c5SYu Xiangning SO_RCVBUF, (const void *)&smb_dos_tcp_rcvbuf, 3340f1702c5SYu Xiangning sizeof (smb_dos_tcp_rcvbuf), CRED()); 335da6c28aaSamw sr->smb_flg |= SMB_FLAGS_LOCK_AND_READ_OK; 3367b59d02dSjb150015 rc = smbsr_encode_result(sr, 13, VAR_BCC, 3373db3f65cSamw "bwwwwwwlYww2.w#cs", 338da6c28aaSamw 13, /* wct */ 339da6c28aaSamw sel_pos, /* dialect index */ 340da6c28aaSamw secmode, /* security mode */ 341da6c28aaSamw SMB_DOS_MAXBUF, /* max buffer size */ 342da6c28aaSamw 1, /* max MPX (temporary) */ 343da6c28aaSamw 1, /* max VCs (temporary, ambiguous) */ 344da6c28aaSamw 3, /* raw mode (s/b 3) */ 345da6c28aaSamw sesskey, /* session key */ 346da6c28aaSamw time_val.tv_sec, /* server time/date */ 347da6c28aaSamw tz_correction, 348da6c28aaSamw (short)keylen, /* Encryption Key Length */ 349da6c28aaSamw /* reserved field handled 2. */ 350da6c28aaSamw VAR_BCC, 351da6c28aaSamw (int)keylen, 352da6c28aaSamw key, /* encryption key */ 353b89a8333Snatalie li - Sun Microsystems - Irvine United States sr->sr_cfg->skc_nbdomain); 354da6c28aaSamw break; 355da6c28aaSamw 356da6c28aaSamw case NT_LM_0_12: 3570f1702c5SYu Xiangning (void) ksocket_setsockopt(sr->session->sock, SOL_SOCKET, 3580f1702c5SYu Xiangning SO_RCVBUF, (const void *)&smb_nt_tcp_rcvbuf, 3590f1702c5SYu Xiangning sizeof (smb_nt_tcp_rcvbuf), CRED()); 3602c2961f8Sjose borrego /* 3612c2961f8Sjose borrego * UNICODE support is required for long share names, 3622c2961f8Sjose borrego * long file names and streams. 3632c2961f8Sjose borrego */ 364da6c28aaSamw capabilities = CAP_LARGE_FILES 3652c2961f8Sjose borrego | CAP_UNICODE 366da6c28aaSamw | CAP_NT_SMBS 367da6c28aaSamw | CAP_STATUS32 368da6c28aaSamw | CAP_NT_FIND 369da6c28aaSamw | CAP_RAW_MODE 370da6c28aaSamw | CAP_LEVEL_II_OPLOCKS 371da6c28aaSamw | CAP_LOCK_AND_READ 372da6c28aaSamw | CAP_RPC_REMOTE_APIS 3732c2961f8Sjose borrego | CAP_LARGE_READX 3742c2961f8Sjose borrego | CAP_LARGE_WRITEX; 375da6c28aaSamw 376da6c28aaSamw /* 377da6c28aaSamw * Turn off Extended Security Negotiation 378da6c28aaSamw */ 379da6c28aaSamw sr->smb_flg2 &= ~SMB_FLAGS2_EXT_SEC; 380da6c28aaSamw 381da6c28aaSamw /* 382da6c28aaSamw * Allow SMB signatures if security challenge response enabled 383da6c28aaSamw */ 384da6c28aaSamw if ((secmode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && 385faa1795aSjb150015 sr->sr_cfg->skc_signing_enable) { 386da6c28aaSamw secmode |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED; 387faa1795aSjb150015 if (sr->sr_cfg->skc_signing_required) 388da6c28aaSamw secmode |= 389da6c28aaSamw NEGOTIATE_SECURITY_SIGNATURES_REQUIRED; 390da6c28aaSamw 391da6c28aaSamw sr->session->secmode = secmode; 392da6c28aaSamw } 3937f667e74Sjose borrego (void) smb_inet_ntop(&sr->session->ipaddr, ipaddr_buf, 3947f667e74Sjose borrego SMB_IPSTRLEN(sr->session->ipaddr.a_family)); 395faa1795aSjb150015 396faa1795aSjb150015 max_mpx_count = sr->sr_cfg->skc_maxworkers; 397da6c28aaSamw 398b89a8333Snatalie li - Sun Microsystems - Irvine United States /* 399b89a8333Snatalie li - Sun Microsystems - Irvine United States * skc_nbdomain is not expected to be aligned. 400b89a8333Snatalie li - Sun Microsystems - Irvine United States * Use temporary buffer to avoid alignment padding 401b89a8333Snatalie li - Sun Microsystems - Irvine United States */ 402*bbf6f00cSJordan Brown buflen = smb_wcequiv_strlen(sr->sr_cfg->skc_nbdomain) + 403*bbf6f00cSJordan Brown sizeof (smb_wchar_t); 404b89a8333Snatalie li - Sun Microsystems - Irvine United States tmpbuf = kmem_zalloc(buflen, KM_SLEEP); 405b89a8333Snatalie li - Sun Microsystems - Irvine United States smb_msgbuf_init(&mb, (uint8_t *)tmpbuf, buflen, 406b89a8333Snatalie li - Sun Microsystems - Irvine United States SMB_MSGBUF_UNICODE); 407b89a8333Snatalie li - Sun Microsystems - Irvine United States if (smb_msgbuf_encode(&mb, "U", 408b89a8333Snatalie li - Sun Microsystems - Irvine United States sr->sr_cfg->skc_nbdomain) < 0) { 409b89a8333Snatalie li - Sun Microsystems - Irvine United States smb_msgbuf_term(&mb); 410b89a8333Snatalie li - Sun Microsystems - Irvine United States kmem_free(tmpbuf, buflen); 411b89a8333Snatalie li - Sun Microsystems - Irvine United States smbsr_error(sr, 0, ERRSRV, ERRerror); 412b89a8333Snatalie li - Sun Microsystems - Irvine United States return (SDRC_ERROR); 413b89a8333Snatalie li - Sun Microsystems - Irvine United States } 414b89a8333Snatalie li - Sun Microsystems - Irvine United States 4157b59d02dSjb150015 rc = smbsr_encode_result(sr, 17, VAR_BCC, 416b89a8333Snatalie li - Sun Microsystems - Irvine United States "bwbwwllllTwbw#c#c", 417da6c28aaSamw 17, /* wct */ 418da6c28aaSamw sel_pos, /* dialect index */ 419da6c28aaSamw secmode, /* security mode */ 420da6c28aaSamw max_mpx_count, /* max MPX (temporary) */ 421da6c28aaSamw 1, /* max VCs (temporary, ambiguous) */ 422da6c28aaSamw (DWORD)smb_maxbufsize, /* max buffer size */ 423da6c28aaSamw 0xFFFF, /* max raw size */ 424da6c28aaSamw sesskey, /* session key */ 425da6c28aaSamw capabilities, 426da6c28aaSamw &time_val, /* system time */ 427da6c28aaSamw tz_correction, 428da6c28aaSamw keylen, /* Encryption Key Length */ 429da6c28aaSamw VAR_BCC, 430da6c28aaSamw (int)keylen, 431da6c28aaSamw key, /* encryption key */ 432b89a8333Snatalie li - Sun Microsystems - Irvine United States buflen, 433b89a8333Snatalie li - Sun Microsystems - Irvine United States tmpbuf); /* skc_nbdomain */ 434b89a8333Snatalie li - Sun Microsystems - Irvine United States 435b89a8333Snatalie li - Sun Microsystems - Irvine United States smb_msgbuf_term(&mb); 436b89a8333Snatalie li - Sun Microsystems - Irvine United States kmem_free(tmpbuf, buflen); 437da6c28aaSamw break; 438da6c28aaSamw 439da6c28aaSamw default: 440b89a8333Snatalie li - Sun Microsystems - Irvine United States sel_pos = -1; 441b89a8333Snatalie li - Sun Microsystems - Irvine United States rc = smbsr_encode_result(sr, 1, 0, "bww", 1, sel_pos, 0); 442b89a8333Snatalie li - Sun Microsystems - Irvine United States return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR); 443da6c28aaSamw } 444da6c28aaSamw 4457b59d02dSjb150015 if (rc != 0) 446faa1795aSjb150015 return (SDRC_ERROR); 4477b59d02dSjb150015 448da6c28aaSamw /* 449da6c28aaSamw * Save the agreed dialect. Note that this value is also 450da6c28aaSamw * used to detect and reject attempts to re-negotiate. 451da6c28aaSamw */ 452da6c28aaSamw sr->session->dialect = dialect; 453da6c28aaSamw sr->session->s_state = SMB_SESSION_STATE_NEGOTIATED; 454faa1795aSjb150015 return (SDRC_SUCCESS); 455da6c28aaSamw } 456da6c28aaSamw 457da6c28aaSamw static void 458da6c28aaSamw smb_get_security_info( 459da6c28aaSamw struct smb_request *sr, 460da6c28aaSamw unsigned short *secmode, 461da6c28aaSamw unsigned char *key, 462da6c28aaSamw unsigned char *keylen, 463da6c28aaSamw uint32_t *sesskey) 464da6c28aaSamw { 465da6c28aaSamw uchar_t tmp_key[8]; 466da6c28aaSamw 467da6c28aaSamw (void) random_get_pseudo_bytes(tmp_key, 8); 468da6c28aaSamw bcopy(tmp_key, &sr->session->challenge_key, 8); 469da6c28aaSamw sr->session->challenge_len = 8; 470da6c28aaSamw *keylen = 8; 471da6c28aaSamw bcopy(tmp_key, key, 8); 472da6c28aaSamw 473da6c28aaSamw sr->session->secmode = NEGOTIATE_SECURITY_CHALLENGE_RESPONSE| 474da6c28aaSamw NEGOTIATE_SECURITY_USER_LEVEL; 475da6c28aaSamw 476da6c28aaSamw (void) random_get_pseudo_bytes(tmp_key, 4); 477da6c28aaSamw sr->session->sesskey = tmp_key[0] | tmp_key[1] << 8 | 478da6c28aaSamw tmp_key[2] << 16 | tmp_key[3] << 24; 479da6c28aaSamw 480da6c28aaSamw *secmode = sr->session->secmode; 481da6c28aaSamw *sesskey = sr->session->sesskey; 482da6c28aaSamw } 483